mlsanityData to 13 Oct 2026

Large Language Models are Autonomous Cyber Defenders

arXiv 2505.04843 ↗First posted 7 May 2025cs.AI cs.CRcited by 15

Not on the map. Why?

Abstract (arXiv)

Fast and effective incident response is essential to prevent adversarial cyberattacks. Autonomous Cyber Defense (ACD) aims to automate incident response through Artificial Intelligence (AI) agents that plan and execute actions. Most ACD approaches focus on single-agent scenarios and leverage Reinforcement Learning (RL). However, ACD RL-trained agents depend on costly training, and their reasoning is not always explainable or transferable. Large Language Models (LLMs) can address these concerns by providing explainable actions in general security contexts. Researchers have explored LLM agents for ACD but have not evaluated them on multi-agent scenarios or interacting with other ACD agents. In this paper, we show the first study on how LLMs perform in multi-agent ACD environments by proposing a new integration to the CybORG CAGE 4 environment. We examine how ACD teams of LLM and RL agents can interact by proposing a novel communication protocol. Our results highlight the strengths and weaknesses of LLMs and RL and help us identify promising research directions to create, train, and deploy future teams of ACD agents.

Key facts. Cited by 15 papers in the map (data through 13 Oct 2026). Builds on 14 of its 33 references that are in the map. First posted on arXiv 7 May 2025.

Builds on

14 of 33 references.

References · 14

  1. 2020Language Models are Few-Shot Learnerscited by 32,320
  2. 2017Proximal Policy Optimization Algorithmscited by 14,592
  3. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,072
  4. 2023Better Zero-Shot Reasoning with Role-Play Promptingcited by 221
  5. 2023Large Language Models as Analogical Reasonerscited by 107
  6. 2021CybORG: A Gym for the Development of Autonomous Cyber Agentscited by 58
  7. 2021Network Environment Design for Autonomous Cyberdefensecited by 30
  8. 2022Beyond CAGE: Investigating Generalization of Learned Autonomous Network Defense Policiescited by 22
  9. 2023NASimEmu: Network Attack Simulator & Emulator for Training Agents Generalizing to Novel Scenarioscited by 20
  10. 2024Depending on yourself when you should: Mentoring LLM with RL agents to become the master in cybersecurity gamescited by 20
  11. 2023Out of the Cage: How Stochastic Parrots Win in Cyber Security Environmentscited by 18
  12. 2024Hierarchical Multi-agent Reinforcement Learning for Cyber Network Defensecited by 17
2 more
  1. 2023Deep Reinforcement Learning for Autonomous Cyber Defence: A Surveycited by 7
  2. 2023Autonomous Intelligent Cyber-defense Agent: Introduction and Overviewcited by 2

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2025: 3; 2026: 12.

15 papers.

Sort:

By area:

  1. 2025Incident Response Planning Using a Lightweight Large Language Model with Reduced Hallucinationcited by 10
  2. 2025Tapas Are Free! Training-Free Adaptation of Programmatic Agents via LLM-Guided Program Synthesis in Dynamic Environmentscited by 9
  3. 2026In-Context Autonomous Network Incident Response: An End-to-End Large Language Model Agent Approachcited by 4
  4. 2026RvB: Automating AI System Hardening via Iterative Red-Blue Gamescited by 2
  5. 2025Large Language Model-Based Reward Design for Deep Reinforcement Learning-Driven Autonomous Cyber Defensecited by 1
  6. 2026Hallucination-Resistant Security Planning with a Large Language Modelcited by 1
  7. 2026A Red Teaming Framework for Evaluating Robustness of AI-enabled Security Orchestration, Automation, and Response Systemscited by 1
  8. 2026Agentic Incident Response through Digital Twin-Enhanced Multiscale Planningcited by 1
  9. 2026Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)cited by 1
  10. 2026STAIR: Effective Incident Response Using an End-to-End Agentic Planning Frameworkcited by 1
  11. 2026Safety-Contract Graph Multi-Agent Reinforcement Learning for Autonomous Network Security Responsecited by 0
  12. 2026COHORT: Collaborative Orchestration for Hardening via Offensive Replay on Emulated Topologiescited by 0
3 more
  1. 2026BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defensecited by 0
  2. 2026No One Architecture Fits All: A Cross-Environment Evaluation of Hierarchical Red Team Agentscited by 0
  3. 2026Towards Hierarchical Cyber Defense with Large Language Models: From Planning to Executioncited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Distilling Knowledge from Large Language Models into Lightweight Reinforcement Learning Agents for Autonomous Cyber Operations
  2. 2026Ask the Expert: LLM-Guided Reinforcement Learning for Autonomous Cyber Defense
  3. 2023LLMs Killed the Script Kiddie: How Agents Supported by Large Language Models Change the Landscape of Network Threat Testing
  4. 2026Autonomous LLM Agents & CTFs: A Second Look
  5. 2026Autonomous Adversary: Red-Teaming in the age of LLM
  6. 2024Multi-Agent Collaboration in Incident Response with Large Language Models
  7. 2025MALCDF: A Distributed Multi-Agent LLM Framework for Real-Time Cyber
  8. 2026LLM agents security duality: a comprehensive survey of self-security and empowered cybersecurity